The vulnerability lies in the TYPO3 extension "HTML5 Video Player vs. Powermail", where untrusted data from a client cookie is passed directly to PHP's unserialize() function. An attacker can craft a serialized payload contained in the cookie, which PHP will deserialize without validation, enabling PHP Object Injection. This flaw allows the attacker to execute arbitrary code on the TYPO3 server, granting full remote compromise of the host.

Any system running the "HTML5 Video Player vs. Powermail" extension before the vendor releases the fix is vulnerable. The issue exists in all versions of the extension that still contain the unserialize call on the cookie data, regardless of TYPO3 framework version.

The CVSS score of 9.3 rates this as a critical flaw with high impact. The vulnerability is exploitable remotely and unauthenticated, and the attacker need only craft a cookie value in a browser request. Even though the EPSS score is not provided, the lack of a KEV listing does not reduce the risk; the flaw is still actively exploitable by automated tools that supply crafted serialized data. The attacker can gain full control of the TYPO3 installation via the vulnerable PHP Object Injection path.